@@ -1566,78 +1566,86 @@ The product shall record log messages indicating security-relevant internal even
Guidance: One type of event whose log message must take care to not accidentally include a secret is failed password authentication attempts. Since people often type their password into the username field, including the username field in the log message may result in including a secret in the log message.
### 5.2.X **TR-SCDL**: Secure deletion
### 5.2.16 TR-SCDL: Secure deletion
#### 5.2.X.x Requirement
#### 5.2.16.1 Requirement
The product shall provide a method of deleting all data and settings and resetting the product to its secure-by-default configuration.
The product shall provide a method of deleting all user data and settings and resetting the product to its secure-by-default configuration.
Guidance: Overwriting all storage or encrypting all data and deleting the key are two secure deletion mechanisms.
Guidance: Overwriting all user-writable storage or encrypting all user data and deleting the key are two secure deletion mechanisms.
#### 5.2.X.x **MI-RSET**: Secure deletion via reset
#### 5.2.16.2 MI-RSET: Secure deletion via reset
The product shall reset to its secure-by-default state after a power cycle or reset command.
* Applicability: Product has the capability for the user to write data and/or settings
* Reference: TR-SCDL
* Objective: Secure deletion
* Preparation: Document every kind of data or setting that may be stored on the product, how to store it on the product, and how to read it from the product
* Preparation: Document every kind of stored data or setting that may be changed by the user on the product, how to store it on the product, and how to read it from the product
* Activities: For each kind of user data or setting that may be stored on the product, write an instance of the data or setting stored on the product that is different from the default and read it from the product; once all kinds of data have been written and read, power cycle or reset the product, and read each kind of data again
* Activities: For each kind of user data or setting that may be stored and changed by the user on the product, write an instance of the data or setting stored on the product that is different from the default and read it from the product; once all kinds of data have been written and read, power cycle or reset the product, and read each kind of data again
* Verdict: If any data or setting is the same for both of the reads => FAIL, otherwise => PASS
* Evidence: Record of each type of data or setting, what data or setting was written, what data or setting was returned by the first read, and what data or setting was returned by the second read, comparison of each one
#### 5.2.X.x **MI-INST**: Secure deletion via reinstallation
#### 5.2.16.3 MI-INST: Secure deletion via reinstallation
The product shall reset to its secure-by-default state after a reinstallation that securely deletes all previous user data or settings.
* Applicability: Product has the capability for the user to write data and/or settings
* Reference: TR-SCDL
* Objective: Secure deletion
* Preparation: Document every kind of data or setting that may be stored on the product, how to store it on the product, and how to read it from the product
* Preparation: Document every kind of data or setting that may be stored and changed by the user on the product, how to store it on the product, and how to read it from the product
* Activities: For each kind of user data or setting that may be stored on the product, write an instance of the data or setting stored on the product that is different from the default and read it from the product; once all kinds of data have been written and read, reinstall the product with the secure delete option, and read the data or settings again
* Activities: For each kind of user data or setting that may be stored and changed by the user on the product, write an instance of the data or setting stored on the product that is different from the default and read it from the product; once all kinds of data have been written and read, reinstall the product with the secure delete option, and read the data or settings again
* Verdict: If any data or setting is the same for both of the reads => FAIL, otherwise => PASS
* Evidence: Record of each type of data or setting, what data or setting was written, what data or setting was returned by the first read, and what data or setting was returned by the second read, comparison of each one
#### 5.2.X.x **MI-DELE**: Secure deletion via secure deletion function
#### 5.2.16.4 MI-DELE: Secure deletion via secure deletion function
The product shall reset to its secure-by-default state after the secure deletion function is used.
> TODO: Make the method of deletion depend on risk tolerance (low or med: simple reformat, high: overwrite once or delete key to encryped storage)
> TODO: Make the method of deletion depend on sensitivity of data stored.
* Applicability: Product has the capability for the user to write data and/or settings
* Reference: TR-SCDL
* Objective: Secure deletion
* Preparation: Document every kind of data or setting that may be stored on the product, how to store it on the product, and how to read it from the product
* Preparation: Document every kind of data or setting that may be stored and changed by the user on the product, how to store it on the product, and how to read it from the product
* Activities: For each kind of user data or setting that may be stored on the product, write an instance of the data or setting stored on the product that is different from the default and read it from the product; once all kinds of data have been written and read, activate the secure deletion function, and read the data or settings again
* Activities: For each kind of user data or setting that may be stored and changed by the user on the product, write an instance of the data or setting stored on the product that is different from the default and read it from the product; once all kinds of data have been written and read, activate the secure deletion function, and read the data or settings again
* Verdict: If any data or setting is the same for both of the reads => FAIL, otherwise => PASS
* Evidence: Record of each type of data or setting, what data or setting was written, what data or setting was returned by the first read, and what data or setting was returned by the second read, comparison of each one
#### 5.2.X.x Mapping of mitigations to risk factors and security profiles
#### 5.2.16.5 Mapping of mitigations to risk factors and security profiles
See Section 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.
### 5.2.X **TR-SDTR**: Secure data read and transfer
### 5.2.17 TR-SDTR: Secure data read and transfer
#### 5.2.X.x Requirement
#### 5.2.17.1 Requirement
The product shall provide a method to read all data and settings from the product, and if provided, securely transfer data and settings to another product.
#### 5.2.X.x **MI-SDRF**: Secure data read from product
#### 5.2.17.2 MI-SDRF: Secure data read from product
The product shall provide a method by which an authorized user can securely read all data and settings from the product.
* Applicability: Product has the capability for the user to write data and/or settings
* Reference: TR-SDTR
* Objective: Secure data read
@@ -1650,9 +1658,11 @@ The product shall provide a method by which an authorized user can securely read
* Evidence: List of data and settings, log message showing success or failure of each read by the authorized user and, if applicable, the unauthorized user
#### 5.2.X.x **MI-SDTR**: Secure data transfer to another product
#### 5.2.17.3 MI-SDTR: Secure data transfer to another product
The product shall provide a method by which an authorized user can securely transfer all data and settings from the product to another product.
If the product provides a method to transfer data and settings to another product, it shall do so securely.
* Applicability: Product has the capability for the user to write data and/or settings and to transfer them to another product.
* Reference: TR-SDTR
@@ -1660,13 +1670,13 @@ The product shall provide a method by which an authorized user can securely tran
* Preparation: Prepare methods by which an unauthorized user could read the data during transfer as outlined in the risk assessment
* Activities: Read the data and settings, initiate the data transfer, and attempt to read the data and settings as an unauthorized user, then read the data and settings from the target product and compare with the data and settings read from the source product
* Activities: Read the data or settings, initiate the data transfer, attempt to read or alter the transferred data and settings as an unauthorized user, read the new data and settings on the target product
* Verdict: No data or settings were read by an an unauthorized user, and the data and settings read from the original product and target product are the same wherever technically possible => PASS, otherwise FAIL
* Verdict: No data or settings could be read or altered by an an unauthorized user, and the data and settings read from the original product and target product are the same wherever technically possible => PASS, otherwise FAIL
* Evidence: List of data and settings, log messages from the attempts to read data as the unauthorized user, data and settings as read from the source product and as read from the target product, comparison explaining technical reasons for any differences in the two veresions
* Evidence: List of data and settings, log messages from the attempts to read or alter data as the unauthorized user, data and settings as read from the source product and as read from the target product, comparison explaining technical reasons for any differences in the two versions
#### 5.2.X.x Mapping of mitigations to risk factors and security profiles
#### 5.2.17.4 Mapping of mitigations to risk factors and security profiles
See Section 5.3 for which mitigations are necessary for which security profiles and Annex C.4 for the rationale.
